Privacy notice

2. Roles and relationship to Alle Gewerke

Ibis Flow GmbH is the sole controller for processing on https://shouldibid.com. Alle Gewerke (alle-gewerke.de) is operated by the same company. When enhanced analysis is enabled, tender fields may be evaluated by the Alle Gewerke backend as same-controller processing, not as a transfer to an independent third-party controller.

This site does not publish a visitor-facing data processing agreement (Art. 28 GDPR). That instrument applies when Alle Gewerke acts as a processor for SaaS customers under their subscription terms. See the Alle Gewerke AVV / DPA and privacy notice.

3. Categories of data

• Tender content you submit: title, description, optional budget band, and a locale hint (de or en). Free text may incidentally include names, emails, phone numbers, or other personal data if you paste them.
• Technical data: IP address, timestamps, user agent, and similar request metadata processed by our hosting and (when enabled) analysis API for security, rate limiting, and delivery.
• Analytics (only after consent): Google Analytics identifiers and usage events (for example form interactions, recommendation outcome, platform clicks). Tender body text is not sent to Google Analytics.
• Cookie preference: stored in your browser (localStorage), not on our servers.

We do not operate user accounts on this site. Contact is by email only; we do not host a contact form that stores enquiry fields in a database.

4. Purposes and legal bases

• Provide the free evaluation tool (heuristic and/or server-assisted analysis, display of results) — Art. 6(1)(b) GDPR where processing is necessary to deliver the service you request, otherwise Art. 6(1)(f) (legitimate interest in operating a free decision-support tool).
• Host and secure the site (Azure Static Web Apps / Functions, logs, abuse prevention) — Art. 6(1)(f).
• Analytics (Google Analytics 4) — Art. 6(1)(a), only after you accept analytics cookies.
• Respond to email enquiries you send to [email protected] — Art. 6(1)(b) or (f), depending on the request.
• Legal obligations where applicable — Art. 6(1)(c).

5. Tender analysis

Analysis may run in your browser with heuristic rules and/or via a same-origin API on https://shouldibid.com (POST /api/analyze) that forwards limited fields to the Alle Gewerke lite-check backend. When the enhanced check is enabled, the payload is typically:

• title
• description
• budgetHint (optional)
• locale (de or en)

API keys and upstream secrets stay on the server. They are never placed in public JavaScript. UI error messages remain generic. By default we do not store submissions as permanent BidCheck / CRM records; processing is for returning a recommendation. Operational logs may retain truncated or redacted request metadata for a limited period (see §11).

6. Hosting

The site and same-origin API are hosted on Microsoft Azure Static Web Apps and Azure Functions. Hosting providers process technical data necessary to deliver the service. Application and platform logs are retained only as long as needed for security and operations, typically no longer than 30 days unless a longer period is required to investigate an incident.

7. Cookies and analytics

Essential operation of the site does not require analytics cookies. Google Analytics 4 (measurement ID associated with this site) loads only after you accept analytics cookies in the consent banner. Declining leaves the evaluation tool fully usable. Your preference is stored locally in the browser. IP anonymisation is enabled for GA where supported by our configuration.

Further detail on Google’s processing is available in Google’s privacy documentation. You may clear local storage or change your browser settings to reset the preference and see the banner again on a future visit.

8. Outbound platforms

Links to Alle Gewerke and TenderHub leave https://shouldibid.com. Continued use of those products is governed by their own terms and privacy notices (for Alle Gewerke, see alle-gewerke.de/datenschutz; for TenderHub, see tenderhub.com.au).

9. Subprocessors and recipients

Categories of recipients involved in operating this site:

10. International transfers

Primary hosting is intended to keep application workloads in the EU where Azure configuration allows. Some subprocessors (notably Google Analytics, and certain Microsoft or Alle Gewerke support services) may process data in third countries. Where required, transfers rely on adequacy decisions, the EU–US Data Privacy Framework where applicable, and/or Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914).

11. Retention

• Tender analysis: request/response for the check; no permanent BidCheck session store by default.
• Hosting / API logs: typically up to 30 days, longer only if needed for security investigation.
• Cookie preference: until you clear browser storage.
• Analytics: according to Google Analytics retention settings for the property.
• Email correspondence: retained only as long as needed to handle your enquiry and related legal obligations.

12. Security

We apply technical and organisational measures appropriate to the risk of this free informational service. Measures for Should I Bid? are described in our TOMs. Measures for the Alle Gewerke analysis backend are described at alle-gewerke.de/tom.

13. Your rights

Subject to statutory conditions, you have the right to access, rectification, erasure, restriction, data portability, and to object to processing based on legitimate interests (Arts. 15–21 GDPR). Where processing is based on consent, you may withdraw consent at any time (Art. 7(3)) without affecting lawfulness before withdrawal.

To exercise rights, contact [email protected]. You also have the right to lodge a complaint with a supervisory authority. For Ibis Flow GmbH in Bavaria, that includes the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

We have not appointed a formal data protection officer; management is responsible for data protection enquiries.

14. Automated decision support

Should I Bid? provides informational recommendations (for example yes / maybe / no style guidance and confidence signals). These outputs are decision support only. They are not solely automated decisions that produce legal effects or similarly significant effects concerning you within the meaning of Art. 22 GDPR. You remain responsible for bid, pricing, and compliance decisions.